Backup & keys

Two things must be in your backup plan: the monitor's database and the encryption key. Without the key, stored connection strings and notification secrets become unreadable.

What is encrypted

Connection strings of the monitored servers and notification secrets are stored in the database, encrypted with a fixed key (AES-256-GCM). The key is deliberately not tied to Windows/DPAPI, so the encrypted value stays portable: it survives updates, service-account changes and moving to another server.

The key

• By default a built-in key is active – everything works with zero configuration, and the values survive restarts and updates.
• For stronger security, set your own key in appsettings.json under Encryption:Key (base64 of exactly 32 bytes). The built-in key can then no longer decrypt your data.

Generate your own key (PowerShell):

[Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))

If you set your own Encryption:Key: keep it secret and back it up together with the database. If it's lost, the affected connection strings must be re-entered.

DataProtection folder

The DataProtection key folder (default %LOCALAPPDATA%/SqlServerHealthMonitor/DataProtection-Keys) still holds the framework keys (auth cookies) and any legacy enc:v1 values. Include it in your backup as well.